Currently, to remotely access a computer network, a user must have a User ID and a password. Typically, a server in the computer network stores the user ID and password in a table. FIG. 1 illustrates a conventional user ID and password table. The table 100 comprises a User ID list 102 and a Hash of Password list 104. The Hash of Password list 104 contains a hash of the passwords corresponding to each user ID. When the user logs into the server, the user provides his/her User ID and password. The server hashes the password provided by the user, and looks up the user's ID in the User ID list 102 in the table 100. The server then compares the stored hashed password corresponding to the user's ID in the Hash of Password list 104 with the hash of the password provided by the user. If they match, then access is granted to the user. If not, then access is denied. By storing the hashes of passwords, the list of passwords cannot be discovered by examining the table.
However, passwords are prone to brute force attacks, such as “dictionary attacks” where an attacker systematically tries known words as passwords. This is a particular security risk especially since most users do not select strong passwords. Also, an attacker can attack “offline”, i.e., with another computer. For example, a table of hashes of the most popular passwords can be prepared on another computer. This table may then be used with the server in an attempt to find a match with a user ID in the table 100.
Accordingly, there exists a need for a method and system for improved security in password-based access to computer networks. The method and system should increase the security of the computer network. The present invention addresses this need.